Vulnerabilities

With the aim of informing, warning and helping professionals with the latest security vulnerabilities in technology systems, we have made a database available for users interested in this information, which is in Spanish and includes all of the latest documented and recognised vulnerabilities.

This repository, with over 75,000 registers, is based on the information from the NVD (National Vulnerability Database) – by virtue of a partnership agreement – through which INCIBE translates the included information into Spanish.

On occasions this list will show vulnerabilities that have still not been translated, as they are added while the INCIBE team is still carrying out the translation process. The CVE (Common Vulnerabilities and Exposures) Standard for Information Security Vulnerability Names is used with the aim to support the exchange of information between different tools and databases.

All vulnerabilities collected are linked to different information sources, as well as available patches or solutions provided by manufacturers and developers. It is possible to carry out advanced searches, as there is the option to select different criteria to narrow down the results, some examples being vulnerability types, manufacturers and impact levels, among others.

Through RSS feeds or Newsletters we can be informed daily about the latest vulnerabilities added to the repository. Below there is a list, updated daily, where you can discover the latest vulnerabilities.

CVE-2020-1777

Publication date:

15/10/2020

Agent names that participates in a chat conversation are revealed in certain parts of the external interface as well as in chat transcriptions inside the tickets, when system is configured to mask real agent names. This issue affects OTRS; 7.0.21 and prior versions, 8.0.6 and prior versions.

Severity CVSS v4.0: Pending analysis

Last modification:

19/10/2021

CVE-2020-15793

Publication date:

15/10/2020

A vulnerability has been identified in Desigo Insight (All versions). The device does not properly set the X-Frame-Options HTTP Header which makes it vulnerable to Clickjacking attacks. This could allow an unauthenticated attacker to retrieve or modify data in the context of a legitimate user by tricking that user to click on a website controlled by the attacker.

Severity CVSS v4.0: Pending analysis

Last modification:

21/10/2020

CVE-2020-15792

Publication date:

15/10/2020

A vulnerability has been identified in Desigo Insight (All versions). The web service does not properly apply input validation for some query parameters in a reserved area. This could allow an authenticated attacker to retrieve data via a content-based blind SQL injection attack.

Severity CVSS v4.0: Pending analysis

Last modification:

15/06/2022

CVE-2020-15794

Publication date:

15/10/2020

A vulnerability has been identified in Desigo Insight (All versions). Some error messages in the web application show the absolute path to the requested resource. This could allow an authenticated attacker to retrieve additional information about the host system.

Severity CVSS v4.0: Pending analysis

Last modification:

18/11/2021

CVE-2020-12504

Publication date:

15/10/2020

Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8508, ES8508F, ES8510, ES8510-XTE, ES9528/ES9528-XT (all versions) and ICRL-M-8RJ45/4SFP-G-DIN, ICRL-M-16RJ45/4CP-G-DIN FW 1.2.3 and below has an active TFTP-Service.

Severity CVSS v4.0: Pending analysis

Last modification:

16/03/2022

CVE-2020-12501

Publication date:

15/10/2020

Severity CVSS v4.0: Pending analysis

Last modification:

17/01/2024

CVE-2020-12502

Publication date:

15/10/2020

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2022

CVE-2020-12503

Publication date:

15/10/2020

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2022

CVE-2020-12500

Publication date:

15/10/2020

Severity CVSS v4.0: Pending analysis

Last modification:

29/04/2022

CVE-2020-25859

Publication date:

15/10/2020

The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validating the input, while handling a SetGatewayUrl() request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAP_CLI can be run via sudo or setuid, this also allows elevating privileges to root. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.

Severity CVSS v4.0: Pending analysis

Last modification:

28/10/2020

CVE-2020-25858

Publication date:

15/10/2020

The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return value of a strstr() or strchr() call in the Tokenizer() function. An attacker who invokes the web interface with a crafted URL can crash the process, causing denial of service. This version of QCMAP is used in many kinds of networking devices, primarily mobile hotspots and LTE routers.

Severity CVSS v4.0: Pending analysis

Last modification:

26/10/2020